Make timezone tests race-safe and complete smoke verification reproducible
Summary
Fix the intermittent timezone-test race seen while verifying cookie-auth removal #641, and make the complete live-test setup reproducible without skipping checks.
- Stop assigning process-global
time.Localin tests. HTTP transport goroutines can read that global throughtime.Now, so the old test setup/cleanup raced with unrelated work. - Pass locations explicitly to the private event-day/sort/boundary helpers. Production still supplies
time.Local; command behavior is unchanged. Keep command-level ordering coverage and independently test positive/negative date crossings and unshifted all-day dates. - Document the Elasticsearch 8, configured Hotcell, local SMTP capture and custom-sender prerequisites. The five reported baseline smoke failures all pass unchanged when these prerequisites are present.
- Give the full SMTP/browser suite a bounded ten-minute deadline. The old five-minute run expired while a healthy test had been running only 11 seconds; SMTP verification alone takes about 90 seconds. Strict mode and every assertion remain unchanged.
Rebased onto main after #641 merged, inheriting cookie-auth removal and Go 1.27.4. git range-diff confirms the patch is unchanged apart from README context adjustments. Fresh verification is complete on d9753b9 with Go 1.27.4: CI is green (21 checks pass, 4 skipped, none failing or pending), and local checks, three full shuffled race repetitions, and all 147 strict live tests pass.
This does not implement the broader account-timezone/day-window feature in #563. No CLI commands/flags, SDK or API contracts change.
Verification
make check: pass.go test -race -shuffle=on -count=3 ./...: pass across the whole repository.- Timezone helper cases: 7/7 across 20 shuffled race repetitions. Three deliberate regressions (UTC timed-day comparison, shifted all-day dates, UTC timed rendering) each make the relevant test fail; mutations restored.
- Four unchanged search/contact/attachment/photo smoke checks: pass with ES8 and the configured cell.
- Full SMTP sender-selection/read-back/capture check: pass with the documented disposable sender and loopback-only Mailpit. No external mail relay was used.
- Complete strict
make test-smoke: 147/147 top-level tests pass, zero skips, including SMTP capture and browser checks, in 343.0 seconds on the rebased head. The default ten-minute deadline is used; no tests or assertions are disabled. - Independent read-only review of the CLI and companion bootstrap changes: no actionable findings (8 changed files across both repositories). Second automated review round after rebasing: Copilot approves; Codex has no findings; cubic reports zero issues across the five-file patch. No open review threads.
Related bootstrap fix / limits
Haystack's own setup currently starts Elasticsearch 7 even though its configuration expects ES8 on port 29208, then suppresses search-indexing errors. Companion haystack PR #9325 corrects that prerequisite, waits for service health and makes indexing failures visible; it does not change API behavior.
The previous Go security blocker is resolved by the Go 1.27.4 fix merged in #641 and inherited by this rebase; this PR's fresh Security check passes. No security gate is disabled or waived. This PR remains unmerged; no release or deployment performed.